diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 5d5a8e1..8c0163b 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -72,7 +72,8 @@ jobs:
           PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
           RENOVATE_DRY_RUN: ${{ inputs.dry_run }}
           RENOVATE_PLATFORM: gitea
-          RENOVATE_ENDPOINT: https://kankali.darkhelm.lan
+          RENOVATE_ENDPOINT_INTERNAL: http://kankali.darkhelm.lan:3001/api/v1
+          RENOVATE_ENDPOINT_EXTERNAL: https://dogar.darkhelm.org/api/v1
           RENOVATE_ENDPOINT_IP: 10.18.75.2
           RENOVATE_ALLOW_INSECURE_TLS: "true"
           RENOVATE_GIT_AUTHOR: Renovate Bot <renovate@darkhelm.org>
@@ -86,37 +87,6 @@ jobs:
           TARGET_REPO="DarkHelm.org/plex-playlist"
           TARGET_ORG="${TARGET_REPO%%/*}"
 
-          RENOVATE_ENDPOINT_EFFECTIVE="${RENOVATE_ENDPOINT%/}"
-          if [[ "${RENOVATE_ENDPOINT_EFFECTIVE}" == */api/v1 ]]; then
-            API_ENDPOINT="${RENOVATE_ENDPOINT_EFFECTIVE}"
-            BASE_ENDPOINT="${RENOVATE_ENDPOINT_EFFECTIVE%/api/v1}"
-          else
-            API_ENDPOINT="${RENOVATE_ENDPOINT_EFFECTIVE}/api/v1"
-            BASE_ENDPOINT="${RENOVATE_ENDPOINT_EFFECTIVE}"
-          fi
-
-          export RENOVATE_ENDPOINT="${BASE_ENDPOINT}"
-          echo "Renovate endpoint (primary): ${RENOVATE_ENDPOINT}"
-          echo "Renovate endpoint (fallback): ${API_ENDPOINT}"
-          echo "Preflight API endpoint: ${API_ENDPOINT}"
-
-          ENDPOINT_HOST="$(printf '%s' "${RENOVATE_ENDPOINT_EFFECTIVE}" | sed -E 's#^https?://([^/]+).*$#\1#')"
-          ENDPOINT_IP="$(getent hosts "${ENDPOINT_HOST}" | awk '{print $1; exit}' || true)"
-          if [ -z "${ENDPOINT_IP}" ] && [ -n "${RENOVATE_ENDPOINT_IP:-}" ]; then
-            ENDPOINT_IP="${RENOVATE_ENDPOINT_IP}"
-            echo "Using configured Renovate endpoint IP fallback: ${ENDPOINT_HOST} -> ${ENDPOINT_IP}"
-            if ! grep -q "${ENDPOINT_HOST}" /etc/hosts; then
-              echo "${ENDPOINT_IP} ${ENDPOINT_HOST}" >> /etc/hosts
-            fi
-          fi
-          DOCKER_ADD_HOST_ARG=""
-          if [ -n "${ENDPOINT_IP}" ]; then
-            DOCKER_ADD_HOST_ARG="--add-host ${ENDPOINT_HOST}:${ENDPOINT_IP}"
-            echo "Renovate container host mapping: ${ENDPOINT_HOST} -> ${ENDPOINT_IP}"
-          else
-            echo "⚠ Unable to resolve ${ENDPOINT_HOST} on runner; proceeding without explicit --add-host"
-          fi
-
           CURL_INSECURE_FLAG=""
           if [ "${RENOVATE_ALLOW_INSECURE_TLS:-false}" = "true" ]; then
             echo "⚠ Renovate insecure TLS mode enabled for self-signed certificate endpoint"
@@ -124,9 +94,79 @@ jobs:
             export NODE_TLS_REJECT_UNAUTHORIZED=0
           fi
 
-          VERSION_STATUS=$(curl -sS -o /tmp/renovate-version-check.json -w "%{http_code}" \
-            ${CURL_INSECURE_FLAG} \
-            "${API_ENDPOINT}/version" || true)
+          configure_endpoint() {
+            endpoint_input="${1%/}"
+            endpoint_ip_fallback="${2:-}"
+
+            if [[ "${endpoint_input}" == */api/v1 ]]; then
+              API_ENDPOINT="${endpoint_input}"
+              BASE_ENDPOINT="${endpoint_input%/api/v1}"
+            else
+              API_ENDPOINT="${endpoint_input}/api/v1"
+              BASE_ENDPOINT="${endpoint_input}"
+            fi
+
+            ENDPOINT_AUTHORITY="$(printf '%s' "${BASE_ENDPOINT}" | sed -E 's#^https?://([^/]+).*$#\1#')"
+            ENDPOINT_HOST="${ENDPOINT_AUTHORITY%%:*}"
+            ENDPOINT_IP="$(getent hosts "${ENDPOINT_HOST}" | awk '{print $1; exit}' || true)"
+            if [ -z "${ENDPOINT_IP}" ] && [ -n "${endpoint_ip_fallback}" ]; then
+              ENDPOINT_IP="${endpoint_ip_fallback}"
+              echo "Using configured Renovate endpoint IP fallback: ${ENDPOINT_HOST} -> ${ENDPOINT_IP}"
+              if ! grep -q "${ENDPOINT_HOST}" /etc/hosts; then
+                echo "${ENDPOINT_IP} ${ENDPOINT_HOST}" >> /etc/hosts
+              fi
+            fi
+
+            DOCKER_ADD_HOST_ARG=""
+            if [ -n "${ENDPOINT_IP}" ]; then
+              DOCKER_ADD_HOST_ARG="--add-host ${ENDPOINT_HOST}:${ENDPOINT_IP}"
+              echo "Renovate container host mapping: ${ENDPOINT_HOST} -> ${ENDPOINT_IP}"
+            else
+              echo "⚠ Unable to resolve ${ENDPOINT_HOST} on runner; proceeding without explicit --add-host"
+            fi
+          }
+
+          select_reachable_endpoint() {
+            for candidate in "${RENOVATE_ENDPOINT_INTERNAL}" "${RENOVATE_ENDPOINT_EXTERNAL}"; do
+              fallback_ip=""
+              if [ "${candidate}" = "${RENOVATE_ENDPOINT_INTERNAL}" ]; then
+                fallback_ip="${RENOVATE_ENDPOINT_IP:-}"
+              fi
+
+              configure_endpoint "${candidate}" "${fallback_ip}"
+              echo "Testing Renovate endpoint candidate: ${API_ENDPOINT}"
+
+              version_status=$(curl -sS -o /tmp/renovate-version-check.json -w "%{http_code}" \
+                ${CURL_INSECURE_FLAG} \
+                "${API_ENDPOINT}/version" || true)
+
+              if [ "${version_status}" = "200" ]; then
+                SELECTED_ENDPOINT_INPUT="${candidate}"
+                VERSION_STATUS="${version_status}"
+                return 0
+              fi
+
+              echo "⚠ Endpoint candidate failed version preflight: ${API_ENDPOINT} (status=${version_status})"
+              if [ -s /tmp/renovate-version-check.json ]; then
+                cat /tmp/renovate-version-check.json || true
+              fi
+            done
+
+            return 1
+          }
+
+          if ! select_reachable_endpoint; then
+            echo "❌ Unable to reach either configured Renovate endpoint"
+            echo "Tried internal: ${RENOVATE_ENDPOINT_INTERNAL}"
+            echo "Tried external: ${RENOVATE_ENDPOINT_EXTERNAL}"
+            exit 1
+          fi
+
+          export RENOVATE_ENDPOINT="${BASE_ENDPOINT}"
+          echo "Renovate endpoint (primary): ${RENOVATE_ENDPOINT}"
+          echo "Renovate endpoint (fallback): ${RENOVATE_ENDPOINT_EXTERNAL}"
+          echo "Preflight API endpoint: ${API_ENDPOINT}"
+
           PLATFORM_VERSION=""
           if [ "${VERSION_STATUS}" = "200" ]; then
             PLATFORM_VERSION=$(sed -n 's/.*"version":"\([^"]*\)".*/\1/p' /tmp/renovate-version-check.json | head -n 1)
@@ -139,7 +179,9 @@ jobs:
             fi
           else
             echo "⚠ Gitea version preflight failed with status ${VERSION_STATUS}"
-            cat /tmp/renovate-version-check.json || true
+            if [ -s /tmp/renovate-version-check.json ]; then
+              cat /tmp/renovate-version-check.json || true
+            fi
           fi
 
           select_token_with_repo_access() {
@@ -197,7 +239,7 @@ jobs:
           SELECTED_TOKEN_SOURCE="${SELECTED_TOKEN_RESULT%%:*}"
           SELECTED_TOKEN="${SELECTED_TOKEN_RESULT#*:}"
           export RENOVATE_TOKEN="${SELECTED_TOKEN}"
-          export RENOVATE_HOST_RULES="[{\"matchHost\":\"${BASE_ENDPOINT}\",\"token\":\"${SELECTED_TOKEN}\",\"authType\":\"Token-Only\"}]"
+          export RENOVATE_HOST_RULES="[{\"matchHost\":\"${ENDPOINT_AUTHORITY}\",\"token\":\"${SELECTED_TOKEN}\",\"authType\":\"Token-Only\"}]"
           unset SELECTED_TOKEN RESULT_TOKEN
 
           echo "✓ Renovate auth preflight passed with ${SELECTED_TOKEN_SOURCE}"